Executive brief
TinyOS, an operating system for low-power wireless devices like sensor networks and smart meters, contains a memory corruption vulnerability. An attacker could exploit this flaw to cause a system crash or force the device into an unpredictable state by providing overly long input strings to the networking stack's debug logging component. This could disrupt the operation of wireless sensor networks or potentially lead to the exposure of sensitive diagnostic information.
Technical details
A global buffer overflow exists in the printfUART implementation of TinyOS <= 2.1.2. The vulnerability is caused by the use of strcat() and sprintf() to format output into a fixed-size global buffer (debugbuf) without verifying the remaining capacity. When the function is called with a string longer than the available buffer space, it results in an out-of-bounds write (CWE-787). A local attacker can trigger this by providing long strings to the ZigBee/IEEE 802.15.4 networking stack, leading to global memory corruption, denial of service, or information disclosure via corrupted adjacent global state. No patch is currently noted in the advisory, and the repository has been archived.
Affected products
- TinyOS TinyOS <= 2.1.2
Timeline
- 2026-01-14: advisory: Initial advisory published by VulnCheck
- 2026-01-14: disclosed: Public disclosure on Full Disclosure mailing list